@aztec/validator-client 0.0.1-commit.993d240 → 0.0.1-commit.9a89641

package/src/proposal_handler.ts

@@ -13,27 +13,36 @@ import {
 import { pick } from '@aztec/foundation/collection';
 import { Fr } from '@aztec/foundation/curves/bn254';
 import { TimeoutError } from '@aztec/foundation/error';
+import { FifoSet } from '@aztec/foundation/fifo-set';
 import type { LogData } from '@aztec/foundation/log';
 import { createLogger } from '@aztec/foundation/log';
 import { retryUntil } from '@aztec/foundation/retry';
 import { DateProvider, Timer } from '@aztec/foundation/timer';
+import { isErrorClass } from '@aztec/foundation/types';
 import type { P2P, PeerId } from '@aztec/p2p';
 import { BlockProposalValidator } from '@aztec/p2p/msg_validators';
 import type { BlockData, L2Block, L2BlockSink, L2BlockSource } from '@aztec/stdlib/block';
 import type { CheckpointReexecutionTracker, ReexecutionOutcome } from '@aztec/stdlib/checkpoint';
 import { getPreviousCheckpointOutHashes, validateCheckpoint } from '@aztec/stdlib/checkpoint';
-import { getEpochAtSlot, getTimestampForSlot } from '@aztec/stdlib/epoch-helpers';
+import { getEpochAtSlot } from '@aztec/stdlib/epoch-helpers';
 import { Gas } from '@aztec/stdlib/gas';
-import type { ITxProvider, ValidatorClientFullConfig, WorldStateSynchronizer } from '@aztec/stdlib/interfaces/server';
+import type {
+  ITxProvider,
+  MerkleTreeWriteOperations,
+  ValidatorClientFullConfig,
+  WorldStateSynchronizer,
+} from '@aztec/stdlib/interfaces/server';
 import {
   type L1ToL2MessageSource,
   accumulateCheckpointOutHashes,
   computeInHashFromL1ToL2Messages,
 } from '@aztec/stdlib/messaging';
 import type { BlockProposal, CheckpointAttestation, CheckpointProposalCore } from '@aztec/stdlib/p2p';
+import type { ConsensusTimetable } from '@aztec/stdlib/timetable';
 import { MerkleTreeId } from '@aztec/stdlib/trees';
-import type { CheckpointGlobalVariables, FailedTx, Tx } from '@aztec/stdlib/tx';
+import type { CheckpointGlobalVariables, FailedTx, Tx, TxHash } from '@aztec/stdlib/tx';
 import {
+  InvalidBlockProposalTxsError,
   ReExFailedTxsError,
   ReExInitialStateMismatchError,
   ReExStateMismatchError,
@@ -49,12 +58,13 @@ export type BlockProposalValidationFailureReason =
   | 'invalid_signature'
   | 'invalid_proposal'
   | 'parent_block_not_found'
-  | 'block_source_not_synced'
   | 'parent_block_wrong_slot'
   | 'in_hash_mismatch'
   | 'global_variables_mismatch'
   | 'block_number_already_exists'
   | 'txs_not_available'
+  | 'duplicate_txs'
+  | 'invalid_embedded_txs'
   | 'state_mismatch'
   | 'failed_txs'
   | 'initial_state_mismatch'
@@ -90,10 +100,12 @@ export type CheckpointProposalValidationFailureReason =
   | 'invalid_fee_asset_price_modifier'
   | 'last_block_not_found'
   | 'block_fetch_error'
+  | 'world_state_not_synced'
   | 'checkpoint_already_published'
   | 'no_blocks_for_slot'
   | 'last_block_archive_mismatch'
   | 'too_many_blocks_in_checkpoint'
+  | 'initial_archive_mismatch'
   | 'checkpoint_header_mismatch'
   | 'archive_mismatch'
   | 'out_hash_mismatch'
@@ -114,6 +126,8 @@ const CHECKPOINT_VALIDATION_REASON_TO_OUTCOME: Record<
   checkpoint_already_published: undefined,
   last_block_not_found: 'unvalidated',
   block_fetch_error: 'unvalidated',
+  world_state_not_synced: 'unvalidated',
+  initial_archive_mismatch: 'unvalidated',
   no_blocks_for_slot: 'unvalidated',
   last_block_archive_mismatch: 'invalid',
   too_many_blocks_in_checkpoint: 'invalid',
@@ -152,7 +166,54 @@ type BlockProposalSlotValidationResult =
   | { isValid: true }
   | { isValid: false; reason: 'block_proposal_beyond_checkpoint' | 'checkpoint_proposal_equivocation' };
 
-/** Handles block and checkpoint proposals for both validator and non-validator nodes. */
+const MAX_TRACKED_INVALID_PROPOSAL_SLOTS = 1000;
+
+/** Block-proposal validation failures that constitute a slashable invalid-block offense. */
+export const SLASHABLE_BLOCK_PROPOSAL_VALIDATION_RESULT: BlockProposalValidationFailureReason[] = [
+  'state_mismatch',
+  'failed_txs',
+  'global_variables_mismatch',
+  'invalid_proposal',
+  'parent_block_wrong_slot',
+  'in_hash_mismatch',
+  'duplicate_txs',
+  'invalid_embedded_txs',
+];
+
+/** Checkpoint-proposal validation failures that constitute a slashable invalid-checkpoint offense. */
+export const SLASHABLE_CHECKPOINT_PROPOSAL_VALIDATION_RESULT: Record<
+  CheckpointProposalValidationFailureReason,
+  boolean
+> = {
+  // enabled
+  ['invalid_fee_asset_price_modifier']: true,
+  ['checkpoint_header_mismatch']: true,
+  // These late mismatches should normally be caught by earlier checks, but if reached after validating the local
+  // checkpoint inputs, the proposer-signed payload disagrees with deterministic recomputation.
+  ['archive_mismatch']: true,
+  ['out_hash_mismatch']: true,
+  ['no_blocks_for_slot']: true,
+  ['too_many_blocks_in_checkpoint']: true,
+  ['checkpoint_validation_failed']: true,
+  ['last_block_archive_mismatch']: true,
+
+  // disabled
+  ['invalid_signature']: false,
+  ['last_block_not_found']: false,
+  ['block_fetch_error']: false,
+  ['world_state_not_synced']: false,
+  // A reorg / divergent local chain, not a proposer offense (mirrors the block path's initial_state_mismatch).
+  ['initial_archive_mismatch']: false,
+  ['checkpoint_already_published']: false,
+};
+
+/**
+ * Handles block and checkpoint proposals for both validator and non-validator nodes. Also tracks which slots
+ * had a slashable invalid proposal or a proposal equivocation, exposing them via the
+ * `InvalidProposalSlotSource` interface consumed by the attested-invalid-proposal slashing watcher. The
+ * tracking is populated as a side effect of validating/re-executing proposals, so any node that re-executes
+ * proposals (the default) can serve it — not only validators.
+ */
 export class ProposalHandler {
   public readonly tracer: Tracer;
 
@@ -165,7 +226,7 @@ export class ProposalHandler {
   };
 
   /** Archiver reference for setting proposed checkpoints (pipelining). Set via register(). */
-  private archiver?: Pick<Archiver, 'addProposedCheckpoint'>;
+  private archiver?: Pick<Archiver, 'addProposedCheckpoint' | 'getProposedCheckpointData'>;
 
   /** Returns current validator addresses for own-proposal detection. Set via register(). */
   private getOwnValidatorAddresses?: () => string[];
@@ -175,6 +236,12 @@ export class ProposalHandler {
 
   private checkpointProposalValidationFailureCallback?: CheckpointProposalValidationFailureCallback;
 
+  /** Slots at which a slashable invalid block or checkpoint proposal was observed. */
+  private readonly slotsWithInvalidProposals = FifoSet.withLimit<SlotNumber>(MAX_TRACKED_INVALID_PROPOSAL_SLOTS);
+
+  /** Slots at which a proposal equivocation was observed; suppresses attested-to-invalid-proposal slashing. */
+  private readonly slotsWithProposalEquivocation = FifoSet.withLimit<SlotNumber>(MAX_TRACKED_INVALID_PROPOSAL_SLOTS);
+
   constructor(
     private checkpointsBuilder: FullNodeCheckpointsBuilder,
     private worldState: WorldStateSynchronizer,
@@ -183,6 +250,7 @@ export class ProposalHandler {
     private txProvider: ITxProvider,
     private blockProposalValidator: BlockProposalValidator,
     private epochCache: EpochCache,
+    private timetable: ConsensusTimetable,
     private config: ValidatorClientFullConfig,
     private blobClient: BlobClientInterface,
     private reexecutionTracker: CheckpointReexecutionTracker,
@@ -220,6 +288,26 @@ export class ProposalHandler {
     this.reexecutionTracker.recordOutcome(slot, archive, 'valid', checkpointNumber);
   }
 
+  /** Whether a slashable invalid block or checkpoint proposal was observed at the given slot (InvalidProposalSlotSource). */
+  public hasInvalidProposals(slotNumber: SlotNumber): boolean {
+    return this.slotsWithInvalidProposals.has(slotNumber);
+  }
+
+  /** Whether a proposal equivocation was observed at the given slot (InvalidProposalSlotSource). */
+  public hasProposalEquivocation(slotNumber: SlotNumber): boolean {
+    return this.slotsWithProposalEquivocation.has(slotNumber);
+  }
+
+  /** Records a slot as having a slashable invalid proposal, for offense observers (sentinel/slasher watchers). */
+  public markInvalidProposalSlot(slotNumber: SlotNumber): void {
+    this.slotsWithInvalidProposals.add(slotNumber);
+  }
+
+  /** Records a slot as having a proposal equivocation, which suppresses attested-to-invalid-proposal slashing. */
+  public markProposalEquivocation(slotNumber: SlotNumber): void {
+    this.slotsWithProposalEquivocation.add(slotNumber);
+  }
+
   /**
    * Registers handlers for block and checkpoint proposals on the p2p client.
    * Records the p2p client so validation can inspect retained proposals.
@@ -231,7 +319,7 @@ export class ProposalHandler {
   register(
     p2pClient: P2P,
     shouldReexecute: boolean,
-    archiver?: Pick<Archiver, 'addProposedCheckpoint'>,
+    archiver?: Pick<Archiver, 'addProposedCheckpoint' | 'getProposedCheckpointData'>,
     getOwnValidatorAddresses?: () => string[],
   ): ProposalHandler {
     this.p2pClient = p2pClient;
@@ -255,6 +343,18 @@ export class ProposalHandler {
           });
           return true;
         } else {
+          // Track invalid proposals / equivocations so offense observers (the attested-invalid-proposal
+          // watcher) work on non-validator nodes too. Validators populate these via their own handlers.
+          // Skip invalid-proposal marking while the escape hatch is open, matching the validator path,
+          // which intentionally disables invalid-block slashing then.
+          if (result.reason === 'checkpoint_proposal_equivocation') {
+            this.markProposalEquivocation(slotNumber);
+          } else if (
+            SLASHABLE_BLOCK_PROPOSAL_VALIDATION_RESULT.includes(result.reason) &&
+            !(await this.epochCache.isEscapeHatchOpenAtSlot(slotNumber))
+          ) {
+            this.markInvalidProposalSlot(slotNumber);
+          }
           this.log.warn(
             `Non-validator block proposal ${blockNumber} at slot ${slotNumber} failed processing with ${result.reason}`,
             { blockNumber: result.blockNumber, slotNumber, reason: result.reason },
@@ -269,6 +369,11 @@ export class ProposalHandler {
 
     p2pClient.registerBlockProposalHandler(blockHandler);
 
+    // p2p detects duplicate (equivocated) proposals without routing them through the handlers above, so mark
+    // the slot as equivocated here. This suppresses false-positive attested-to-invalid-proposal slashing on
+    // non-validator offense collectors. Validators overwrite this with their own richer handler.
+    p2pClient.registerDuplicateProposalCallback(info => this.markProposalEquivocation(info.slot));
+
     // All-nodes checkpoint proposal handler: validates, caches, and sets proposed checkpoint for pipelining.
     // Runs for all nodes (validators and non-validators). Validators get the cached result in the
     // validator-specific callback (attestToCheckpointProposal) which runs after this one.
@@ -297,25 +402,35 @@ export class ProposalHandler {
           return undefined;
         }
 
-        // For own proposals, skip validation and return: the proposer already built and validated the
-        // checkpoint, and the sequencer's checkpoint proposal job pushed the proposed checkpoint to the
-        // archiver from local data before broadcasting. Gossipsub doesn't echo our own messages back, so
-        // this branch is normally unreachable — it remains as defense if an own proposal arrives by some
-        // other path.
+        // A proposal is "own" when it was signed by a validator key this node also owns. The true local
+        // proposer already built, validated, and stored this checkpoint before broadcasting, so a matching
+        // proposed checkpoint is already in its archiver — skip the redundant re-validation. An HA peer that
+        // shares the proposer's keys sees the same "own" proposal over gossip but never built it, so it has
+        // nothing stored; it falls through to the normal validate-and-persist path below to hydrate the
+        // proposed-checkpoint metadata it needs to build the next slot on top of this checkpoint.
         const proposer = proposal.getSender();
         const ownAddresses = this.getOwnValidatorAddresses?.();
         const isOwnProposal = proposer && ownAddresses?.some(addr => addr === proposer.toString());
 
         if (isOwnProposal) {
-          this.log.debug(`Skipping validation for own checkpoint proposal at slot ${proposal.slotNumber}`);
-          return undefined;
+          const existing = await this.archiver?.getProposedCheckpointData({ slot: proposal.slotNumber });
+          if (existing?.archive.root.equals(proposal.archive)) {
+            this.log.debug(`Skipping sync for existing own checkpoint proposal at slot ${proposal.slotNumber}`);
+            return undefined;
+          }
         }
 
         const result = await this.handleCheckpointProposal(proposal, proposalInfo);
         if (!result.isValid) {
+          // Track invalid checkpoint proposals so offense observers (the attested-invalid-proposal watcher)
+          // work on non-validator nodes too. This handler runs for all nodes; validators also mark via the
+          // failure callback below (idempotent).
+          if (SLASHABLE_CHECKPOINT_PROPOSAL_VALIDATION_RESULT[result.reason]) {
+            this.markInvalidProposalSlot(proposal.slotNumber);
+          }
           await this.checkpointProposalValidationFailureCallback?.(proposal, result, proposalInfo);
-        } else if (this.archiver && this.epochCache.isProposerPipeliningEnabled()) {
-          const set = await this.setProposedCheckpointFromValidation(proposal);
+        } else if (this.archiver) {
+          const set = await this.setProposedCheckpoint(proposal);
           if (set) {
             this.metrics?.recordCheckpointProposalToPipelinedStateDuration(pipeliningTimer.ms());
           }
@@ -338,7 +453,6 @@ export class ProposalHandler {
   ): Promise<BlockProposalValidationResult> {
     const slotNumber = proposal.slotNumber;
     const proposer = proposal.getSender();
-    const config = this.checkpointsBuilder.getConfig();
 
     // Reject proposals with invalid signatures
     if (!proposer) {
@@ -366,6 +480,20 @@ export class ProposalHandler {
       return { isValid: false, reason: 'invalid_proposal' };
     }
 
+    // A tx can only appear once in a block: the second copy would emit nullifiers already emitted by the
+    // first. This is not a relaying-peer fault, so it passes gossip validation and is classified here as
+    // proposer misbehavior. Tx collection also reconciles a deduplicated hash set against the full list,
+    // so it must not be handed a proposal with repeated hashes.
+    const uniqueTxHashes = new Set(proposal.txHashes.map(txHash => txHash.toString()));
+    if (uniqueTxHashes.size !== proposal.txHashes.length) {
+      this.log.warn(`Proposal lists duplicate tx hashes, skipping processing`, {
+        ...proposalInfo,
+        txCount: proposal.txHashes.length,
+        uniqueTxCount: uniqueTxHashes.size,
+      });
+      return { isValid: false, reason: 'duplicate_txs' };
+    }
+
     const retainedSlotValidation = await this.validateNewBlockInSlot(proposal);
     if (!retainedSlotValidation.isValid) {
       this.log.info(`Block proposal conflicts with retained proposals, skipping archiver processing`, {
@@ -376,20 +504,9 @@ export class ProposalHandler {
       return { isValid: false, blockNumber: proposal.blockNumber, reason: retainedSlotValidation.reason };
     }
 
-    // Ensure the block source is synced before checking for existing blocks,
-    // since a proposed checkpoint prune may remove blocks we'd otherwise find.
-    // This affects mostly the block_number_already_exists check, since a pending
-    // checkpoint prune could remove a block that would conflict with this proposal.
-    // When pipelining is enabled, the proposer builds ahead of L1 submission, so the
-    // block source won't have synced to the proposed slot yet. Skip the sync wait to
-    // avoid eating into the attestation window.
-    if (!this.epochCache.isProposerPipeliningEnabled()) {
-      const blockSourceSync = await this.waitForBlockSourceSync(slotNumber);
-      if (!blockSourceSync) {
-        this.log.warn(`Block source is not synced, skipping processing`, proposalInfo);
-        return { isValid: false, reason: 'block_source_not_synced' };
-      }
-    }
+    // The proposer builds ahead of L1 submission under pipelining, so the block source won't have
+    // synced to the proposed slot yet. We deliberately do not wait for it to sync here, to avoid
+    // eating into the attestation window.
 
     // Check that the parent proposal is a block we know, otherwise reexecution would fail.
     // If we don't find it immediately, we keep retrying for a while; it may be we still
@@ -417,8 +534,12 @@ export class ProposalHandler {
         : BlockNumber(parentBlock.header.getBlockNumber() + 1);
     proposalInfo.blockNumber = blockNumber;
 
-    // Check that this block number does not exist already
-    const existingBlock = await this.blockSource.getBlockData({ number: blockNumber });
+    // Check that this block number does not exist already. During a reorg the archiver can still hold a
+    // stale block at this number (a different archive, about to be pruned) while the proposal carries the
+    // rebuilt replacement; resolveExistingBlockAtNumber waits for the local prune in that case so the
+    // rebuilt block is processed in time to attest, rather than being permanently dropped on a bare
+    // number collision.
+    const existingBlock = await this.resolveExistingBlockAtNumber(blockNumber, proposal.archive, slotNumber);
     if (existingBlock) {
       this.log.warn(`Block number ${blockNumber} already exists, skipping processing`, proposalInfo);
       return { isValid: false, blockNumber, reason: 'block_number_already_exists' };
@@ -426,10 +547,11 @@ export class ProposalHandler {
 
     // Collect txs from the proposal. We start doing this as early as possible,
     // and we do it even if we don't plan to re-execute the txs, so that we have them if another node needs them.
-    const { txs, missingTxs } = await this.txProvider.getTxsForBlockProposal(proposal, blockNumber, {
-      pinnedPeer: proposalSender,
-      deadline: this.getReexecutionDeadline(slotNumber, config),
-    });
+    const collected = await this.collectProposalTxs(proposal, blockNumber, proposalSender, proposalInfo);
+    if (collected === 'invalid_embedded_txs') {
+      return { isValid: false, blockNumber, reason: collected };
+    }
+    const { txs, missingTxs } = collected;
 
     // Record the tx-collection outcome on the re-execution tracker
     this.reexecutionTracker.recordTxsCollected(slotNumber, proposal.indexWithinCheckpoint, missingTxs.length === 0);
@@ -479,7 +601,7 @@ export class ProposalHandler {
       epoch,
       checkpointNumber,
       l1Constants: this.epochCache.getL1Constants(),
-      pipeliningEnabled: this.epochCache.isProposerPipeliningEnabled(),
+      pipeliningEnabled: true,
       log: this.log,
     });
 
@@ -502,7 +624,7 @@ export class ProposalHandler {
     }
 
     // If we succeeded, push this block into the archiver (unless disabled)
-    if (reexecutionResult?.block && this.config.skipPushProposedBlocksToArchiver === false) {
+    if (reexecutionResult?.block && !this.config.skipPushProposedBlocksToArchiver) {
       await this.blockSource.addBlock(reexecutionResult.block);
     }
 
@@ -514,6 +636,36 @@ export class ProposalHandler {
     return { isValid: true, blockNumber, reexecutionResult };
   }
 
+  /**
+   * Collects the txs for a proposal, returning `invalid_embedded_txs` if the proposal carries a tx that fails
+   * minimum integrity validation. That is proposer misbehavior — the proposal signs both the tx hashes and the
+   * tx objects — so the caller turns it into an invalid-proposal result that reaches slashing and invalid-slot
+   * accounting, rather than letting it escape as an exception. Any other collection error is a local failure
+   * and keeps propagating.
+   */
+  private async collectProposalTxs(
+    proposal: BlockProposal,
+    blockNumber: BlockNumber,
+    proposalSender: PeerId,
+    proposalInfo: LogData,
+  ): Promise<{ txs: Tx[]; missingTxs: TxHash[] } | 'invalid_embedded_txs'> {
+    try {
+      return await this.txProvider.getTxsForBlockProposal(proposal, blockNumber, {
+        pinnedPeer: proposalSender,
+        deadline: this.getReexecutionDeadline(proposal.slotNumber),
+      });
+    } catch (error) {
+      if (!isErrorClass(error, InvalidBlockProposalTxsError)) {
+        throw error;
+      }
+      this.log.warn(`Block proposal carries ${error.invalidTxs.length} invalid txs`, {
+        ...proposalInfo,
+        invalidTxs: error.invalidTxs.map(({ txHash, reasons }) => ({ txHash: txHash.toString(), reasons })),
+      });
+      return 'invalid_embedded_txs';
+    }
+  }
+
   private async validateNewBlockInSlot(blockProposal: BlockProposal): Promise<BlockProposalSlotValidationResult> {
     if (!this.p2pClient) {
       return { isValid: true };
@@ -536,16 +688,14 @@ export class ProposalHandler {
 
   private async getParentBlock(proposal: BlockProposal): Promise<'genesis' | BlockData | undefined> {
     const parentArchive = proposal.blockHeader.lastArchive.root;
-    const config = this.checkpointsBuilder.getConfig();
     const { genesisArchiveRoot } = await this.blockSource.getGenesisValues();
 
     if (parentArchive.equals(genesisArchiveRoot)) {
       return 'genesis';
     }
 
-    const deadline = this.getReexecutionDeadline(proposal.slotNumber, config);
-    const currentTime = this.dateProvider.now();
-    const timeoutDurationMs = deadline.getTime() - currentTime;
+    const deadline = this.getReexecutionDeadline(proposal.slotNumber);
+    const timeoutDurationMs = deadline.getTime() - this.dateProvider.now();
 
     try {
       return (
@@ -556,7 +706,7 @@ export class ProposalHandler {
               () =>
                 this.blockSource.syncImmediate().then(() => this.blockSource.getBlockData({ archive: parentArchive })),
               'force archiver sync',
-              timeoutDurationMs / 1000,
+              { deadline, dateProvider: this.dateProvider },
               0.5,
             ))
       );
@@ -570,6 +720,63 @@ export class ProposalHandler {
     }
   }
 
+  /**
+   * Resolves whether a block genuinely already exists at `blockNumber`. Returns the existing block only if
+   * it is a true duplicate of the proposal (matching archive). During a reorg the archiver can still hold a
+   * stale fork at this number (different archive) that is about to be pruned; in that case this forces L1
+   * sync and waits, bounded by the re-execution deadline, for the prune to land, then returns `undefined` so
+   * the rebuilt block proposal can be processed in time to attest. If the prune does not complete before the
+   * deadline it returns the stale block, so the caller falls back to the safe `block_number_already_exists`
+   * rejection.
+   */
+  private async resolveExistingBlockAtNumber(
+    blockNumber: BlockNumber,
+    proposalArchive: Fr,
+    slotNumber: SlotNumber,
+  ): Promise<BlockData | undefined> {
+    const existingBlock = await this.blockSource.getBlockData({ number: blockNumber });
+    if (!existingBlock || existingBlock.archive.root.equals(proposalArchive)) {
+      return existingBlock;
+    }
+
+    // A different block already occupies this number: it may be a stale fork being pruned during a reorg, not a
+    // genuine duplicate. Wait for the local prune rather than permanently rejecting the proposal.
+    const deadline = this.getReexecutionDeadline(slotNumber);
+    if (deadline.getTime() - this.dateProvider.now() <= 0) {
+      return existingBlock;
+    }
+
+    this.log.warn(`Block number ${blockNumber} already exists, awaiting potential prune`, {
+      blockNumber,
+      existingArchive: existingBlock.archive.root.toString(),
+      proposalArchive: proposalArchive.toString(),
+    });
+
+    try {
+      const { block } = await retryUntil(
+        async () => {
+          await this.blockSource.syncImmediate();
+          const block = await this.blockSource.getBlockData({ number: blockNumber });
+          // Resolve once the existing block is gone (pruned) or has been replaced by one matching the
+          // proposal — the same condition as the early return above. A matching block is returned so the
+          // caller still treats it as a genuine duplicate; an `undefined` (pruned) block lets the proposal
+          // be processed. Wrap in an object so the `undefined` case is still a truthy retry result.
+          return block === undefined || block.archive.root.equals(proposalArchive) ? { block } : undefined;
+        },
+        `prune of stale block ${blockNumber}`,
+        { deadline, dateProvider: this.dateProvider },
+        0.5,
+      );
+      return block;
+    } catch (err) {
+      if (err instanceof TimeoutError) {
+        this.log.warn(`Timed out waiting for stale block ${blockNumber} to be pruned`, { blockNumber });
+        return existingBlock;
+      }
+      throw err;
+    }
+  }
+
   private computeCheckpointNumber(
     proposal: BlockProposal,
     parentBlock: 'genesis' | BlockData,
@@ -693,52 +900,14 @@ export class ProposalHandler {
     return undefined;
   }
 
-  private getReexecutionDeadline(
-    slotNumber: SlotNumber,
-    config: { l1GenesisTime: bigint; slotDuration: number },
-  ): Date {
-    // Under proposer pipelining, the proposal slot may be ahead of wall clock time.
-    // Reexecution budgets should still be bounded by the current slot we are in now.
-    const wallclockSlot = slotNumber - this.epochCache.pipeliningOffset();
-    const nextSlotTimestampSeconds = Number(getTimestampForSlot(SlotNumber(wallclockSlot + 1), config));
-    return new Date(nextSlotTimestampSeconds * 1000);
-  }
-
-  /** Waits for the block source to sync L1 data up to at least the slot before the given one. */
-  private async waitForBlockSourceSync(slot: SlotNumber): Promise<boolean> {
-    const deadline = this.getReexecutionDeadline(slot, this.checkpointsBuilder.getConfig());
-    const timeoutMs = deadline.getTime() - this.dateProvider.now();
-    if (slot === 0) {
-      return true;
-    }
-
-    // Make a quick check before triggering an archiver sync
-    // If we are pipelining and have a pending checkpoint number stored, we will allow the block proposal to be for a slot further
-    const syncedSlot = await this.blockSource.getSyncedL2SlotNumber();
-    if (syncedSlot !== undefined && syncedSlot + 1 + this.epochCache.pipeliningOffset() >= slot) {
-      return true;
-    }
-
-    try {
-      // Trigger an immediate sync of the block source, and wait until it reports being synced to the required slot
-      return await retryUntil(
-        async () => {
-          await this.blockSource.syncImmediate();
-          const updatedSyncedSlot = await this.blockSource.getSyncedL2SlotNumber();
-          return updatedSyncedSlot !== undefined && updatedSyncedSlot + 1 >= slot;
-        },
-        'wait for block source sync',
-        timeoutMs / 1000,
-        0.5,
-      );
-    } catch (err) {
-      if (err instanceof TimeoutError) {
-        this.log.warn(`Timed out waiting for block source to sync to slot ${slot}`);
-        return false;
-      } else {
-        throw err;
-      }
-    }
+  /**
+   * Hard re-execution/validation deadline for any block or checkpoint proposal targeting `slotNumber`:
+   * the single consensus `attestation_deadline` (`target_slot_start + S - 2E`). This is the latest the
+   * checkpoint can land on L1 in the target slot; all nodes agree on it. Loosened from the previous
+   * next-wall-clock-slot-boundary bound (see the timetable spec / refactor notes).
+   */
+  private getReexecutionDeadline(slotNumber: SlotNumber): Date {
+    return new Date(this.timetable.getAttestationDeadline(slotNumber) * 1000);
   }
 
   private getReexecuteFailureReason(err: any): BlockProposalValidationFailureReason {
@@ -818,7 +987,7 @@ export class ProposalHandler {
     );
 
     // Build the new block
-    const deadline = this.getReexecutionDeadline(slot, config);
+    const deadline = this.getReexecutionDeadline(slot);
     const maxBlockGas =
       this.config.validateMaxL2BlockGas !== undefined || this.config.validateMaxDABlockGas !== undefined
         ? new Gas(this.config.validateMaxDABlockGas ?? Infinity, this.config.validateMaxL2BlockGas ?? Infinity)
@@ -950,15 +1119,15 @@ export class ProposalHandler {
   ): Promise<CheckpointProposalValidationResult> {
     const slot = proposal.slotNumber;
 
-    // Block-sync deadline = the moment the proposer can no longer publish this checkpoint to L1.
-    // With pipelining off that's the end of the proposal's own slot; with pipelining on the
-    // proposal is built one slot ahead, so the publication deadline is the start of the target
-    // slot. `getReexecutionDeadline` handles both cases.
-    const config = this.checkpointsBuilder.getConfig();
-    const deadline = this.getReexecutionDeadline(slot, config);
-    const timeoutSeconds = Math.max(1, Math.floor((deadline.getTime() - this.dateProvider.now()) / 1000));
+    // Block-sync/validation deadline = the single consensus attestation_deadline (target_slot_start + S
+    // - 2E): the latest moment the proposer can submit this checkpoint and still have it land on L1 in
+    // the target slot. Keeping validation/attestation alive until then lets validators keep attesting
+    // right up to the proposer's real publish cutoff.
+    const deadline = this.getReexecutionDeadline(slot);
 
-    // Wait for last block to sync by archive
+    // Wait for last block to sync by archive. The deadline is passed to retryUntil as an absolute date so
+    // the remaining budget is derived from the date provider; a deadline already in the past times out
+    // after a single attempt instead of looping (the immediate-timeout semantics of the deadline overload).
     let lastBlockData;
     try {
       lastBlockData = await retryUntil(
@@ -967,7 +1136,7 @@ export class ProposalHandler {
           return await this.blockSource.getBlockData({ archive: proposal.archive });
         },
         `waiting for block with archive ${proposal.archive.toString()} for slot ${slot}`,
-        timeoutSeconds,
+        { deadline, dateProvider: this.dateProvider },
         0.5,
       );
     } catch (err) {
@@ -1015,6 +1184,7 @@ export class ProposalHandler {
       };
     }
 
+    // Note this condition should never trigger, since we dont process block proposals that exceed indexWithinCheckpoint
     const maxBlocksPerCheckpoint = this.config.maxBlocksPerCheckpoint;
     if (maxBlocksPerCheckpoint !== undefined && blocks.length > maxBlocksPerCheckpoint) {
       this.log.warn(`Checkpoint proposal exceeds maxBlocksPerCheckpoint`, {
@@ -1050,13 +1220,45 @@ export class ProposalHandler {
       epoch,
       checkpointNumber,
       l1Constants: this.epochCache.getL1Constants(),
-      pipeliningEnabled: this.epochCache.isProposerPipeliningEnabled(),
+      pipeliningEnabled: true,
       log: this.log,
     });
 
-    // Fork world state at the block before the first block
+    // Fork world state at the block before the first block. getFork syncs world state to the parent block
+    // first (see its doc): the block source (archiver) can already hold the block while world state still
+    // trails it by one, and forking a not-yet-applied block throws a raw tree error that would otherwise
+    // escape as an uncaught gossipsub error. We pass the parent's expected block hash so the sync detects a
+    // world-state reorg (undefined for the genesis parent, where no block exists to pin). On failure we map
+    // to a clean validation result rather than letting it escape.
     const parentBlockNumber = BlockNumber(firstBlock.number - 1);
-    await using fork = await this.checkpointsBuilder.getFork(parentBlockNumber);
+    let forkResult: MerkleTreeWriteOperations;
+    try {
+      const parentBlockHash = (await this.blockSource.getBlockData({ number: parentBlockNumber }))?.blockHash;
+      forkResult = await this.checkpointsBuilder.getFork(parentBlockNumber, parentBlockHash);
+    } catch (err) {
+      this.log.warn(`Failed to fork world state at block ${parentBlockNumber} for checkpoint proposal`, {
+        ...proposalInfo,
+        parentBlockNumber,
+        err,
+      });
+      return { isValid: false, reason: 'world_state_not_synced', checkpointNumber };
+    }
+    await using fork = forkResult;
+
+    // Verify the fork's archive root matches the checkpoint's expected starting archive (the archive after
+    // the parent block). A mismatch means world state forked from a different chain than the proposal was
+    // built on (e.g. a reorg), so recomputing the checkpoint against it would be meaningless. This mirrors
+    // the block-proposal re-execution check and fails fast with a clean, non-slashable result instead of a
+    // confusing downstream mismatch.
+    const forkArchiveRoot = new Fr((await fork.getTreeInfo(MerkleTreeId.ARCHIVE)).root);
+    if (!forkArchiveRoot.equals(proposal.checkpointHeader.lastArchiveRoot)) {
+      this.log.warn(`Fork archive root does not match checkpoint proposal's last archive`, {
+        ...proposalInfo,
+        forkArchiveRoot: forkArchiveRoot.toString(),
+        expectedLastArchiveRoot: proposal.checkpointHeader.lastArchiveRoot.toString(),
+      });
+      return { isValid: false, reason: 'initial_archive_mismatch', checkpointNumber };
+    }
 
     // Create checkpoint builder with all existing blocks
     const checkpointBuilder = await this.checkpointsBuilder.openCheckpoint(
@@ -1178,11 +1380,11 @@ export class ProposalHandler {
   }
 
   /**
-   * Derives proposed checkpoint data from validated blocks and sets it on the archiver.
-   * Used after successful validation of a foreign proposal.
-   * Does not retry since we already waited for the block during validation.
+   * Derives proposed checkpoint data from validated blocks and sets it on the archiver, so this node can
+   * pipeline building on top of the checkpoint. Does not retry, since validation already waited for the
+   * last block to sync.
    */
-  private async setProposedCheckpointFromValidation(proposal: CheckpointProposalCore): Promise<boolean> {
+  private async setProposedCheckpoint(proposal: CheckpointProposalCore): Promise<boolean> {
     if (!this.archiver) {
       return false;
     }